如何在VNET CIDR变更时让Terraform重建与Virtual Hub的VNET对等连接？

我尝试修改VNET的CIDR，生成的Terraform执行计划如下：

# module.bootstrap.module.vnets["australiaeast"].azurerm_subnet.subnet["aus"] will be updated in-place
  ~ resource "azurerm_subnet" "subnet" {
      ~ address_prefixes                               = [
          - "10.86.136.0/24",
          + "10.138.136.0/24",
        ]
        id                                             = "..."
        name                                           = "..."
        # (8 unchanged attributes hidden)
    }

  # module.bootstrap.module.vnets["australiaeast"].azurerm_virtual_network.vnet["vnet0"] will be updated in-place
  ~ resource "azurerm_virtual_network" "vnet" {
      ~ address_space           = [
          - "10.86.136.0/22",
          + "10.138.136.0/22",
        ]
      ~ dns_servers             = [
          - "10.86.10.36",
          - "10.86.10.37",
          + "10.138.10.36",
          + "10.138.10.37",
        ]
        id                      = "..."
        name                    = "..."
        # (5 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

但执行该计划时失败，报错信息如下：

Error: creating/updating Virtual Network: (Name "..." / Resource Group "..."): network.VirtualNetworksClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="AddressSpaceUpdateNotSupportedForVNetPeeredWithVHub" Message="Address space update not supported in virtual network ... as it is peered with managed vNet (vhub) .... Please delete hub virtual network connection, update the address space and then recreate hub virtual network connection." Details=[]

我原本以为AzureRM Provider会自动识别此场景并规划重建Virtual Hub连接，但实际并非如此。我的现有Terraform代码如下：

data "azurerm_virtual_hub" "vhub" {
  provider            = azurerm.ss101
  name                = "..."
  resource_group_name = local.vhub_rg_name
}

resource "azurerm_virtual_hub_connection" "spoke" {
  provider                  = azurerm.ss101
  name                      = "${var.app_vnet.name}-connection"
  virtual_hub_id            = data.azurerm_virtual_hub.vhub.id
  remote_virtual_network_id = var.app_vnet.id
  internet_security_enabled = true

  routing {
    associated_route_table_id = "..."
    propagated_route_table {
      route_table_ids = [
        for region in keys(local.transit_map) : "..."
      ]
      labels = ["default"]
    }
  }
}

我的问题：能否修改上述代码，让var.app_vnet的VNET CIDR变更时，Virtual Hub连接先被删除，待VNET CIDR更新完成后再重新创建？是否可行？

可行，通过Terraform的replace_triggered_by元参数即可实现该逻辑，具体修改如下：

data "azurerm_virtual_hub" "vhub" {
  provider            = azurerm.ss101
  name                = "..."
  resource_group_name = local.vhub_rg_name
}

resource "azurerm_virtual_hub_connection" "spoke" {
  provider                  = azurerm.ss101
  name                      = "${var.app_vnet.name}-connection"
  virtual_hub_id            = data.azurerm_virtual_hub.vhub.id
  remote_virtual_network_id = var.app_vnet.id
  internet_security_enabled = true

  # 监听VNET地址空间变更，触发本资源的替换操作（先删后建）
  replace_triggered_by = [var.app_vnet.address_space]

  routing {
    associated_route_table_id = "..."
    propagated_route_table {
      route_table_ids = [
        for region in keys(local.transit_map) : "..."
      ]
      labels = ["default"]
    }
  }
}

原理说明 #

• replace_triggered_by会监控var.app_vnet.address_space的取值变化，一旦CIDR修改，Terraform会将该Virtual Hub连接标记为需要替换，即先销毁现有连接，再创建新连接。
• 由于azurerm_virtual_hub_connection依赖var.app_vnet，Terraform会自动调整执行顺序：
  1. 销毁现有Virtual Hub连接
  2. 更新VNET的地址空间与子网配置
  3. 重新创建Virtual Hub连接
• 该流程完全符合Azure的限制要求，可避免原报错问题。

注意事项 #

• 确保var.app_vnet对象包含address_space属性（即传入的VNET资源需暴露该字段）。
• 执行前务必检查Terraform计划，确认操作顺序为销毁连接 → 更新VNET → 创建连接。
• 操作过程中会短暂中断VNET与Virtual Hub之间的网络连通性，建议在业务低峰期执行。

内容的提问来源于stack exchange，提问作者mark